From 2f0406ab64d66b9b556a43bc41a2299e693e8799 Mon Sep 17 00:00:00 2001
From: malken21 <77374813+malken21@users.noreply.github.com>
Date: Fri, 5 Jun 2026 17:47:36 +0900
Subject: [PATCH 1/2] Commit Terraform lock and update workflows

Add a composite GitHub Action to commit .terraform.lock.hcl when it changes, and update the Terraform CI workflows. terraform-apply and terraform-plan now set TF_CLI_ARGS and relevant TF/AWS/Cloudflare env vars, use actions/checkout@v6 (with PR ref for plan), install HashiCorp Terraform, run terraform init with the R2 backend config, invoke the new commit-action, and run terraform plan/apply. Also set permissions to allow writes and ignore .terraform.lock.hcl for apply triggers.
---
 .../commit-terraform-lock-file/action.yml     | 20 +++++++++++
 .github/workflows/terraform-apply.yml         | 29 ++++++++--------
 .github/workflows/terraform-plan.yml          | 34 +++++--------------
 3 files changed, 42 insertions(+), 41 deletions(-)
 create mode 100644 .github/actions/commit-terraform-lock-file/action.yml

diff --git a/.github/actions/commit-terraform-lock-file/action.yml b/.github/actions/commit-terraform-lock-file/action.yml
new file mode 100644
index 0000000..22a8ce2
--- /dev/null
+++ b/.github/actions/commit-terraform-lock-file/action.yml
@@ -0,0 +1,20 @@
+name: "Commit Terraform Lock File"
+description: "Commit Terraform lock file."
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+        git add .terraform.lock.hcl
+
+        if git diff --staged --quiet; then
+          echo "No Terraform lock file changes."
+          exit 0
+        fi
+
+        git commit -m "chore: update terraform lock file"
+        git push
diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
index 560129a..72c5317 100644
--- a/.github/workflows/terraform-apply.yml
+++ b/.github/workflows/terraform-apply.yml
@@ -2,34 +2,34 @@ name: "Terraform Apply"
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+    paths-ignore:
+      - ".terraform.lock.hcl"
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   apply:
-    name: "Terraform Apply"
     runs-on: ubuntu-latest
-    
+    environment: production
+    env:
+      TF_CLI_ARGS: "-no-color"
+
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
 
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@v4
 
-      - name: Terraform Init
+      - run: terraform init -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        run: |
-          terraform init \
-            -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
 
-      - name: Terraform Apply
+      - uses: ./.github/actions/commit-terraform-lock-file
+
+      - run: terraform apply -auto-approve
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
@@ -38,4 +38,3 @@ jobs:
           TF_VAR_toropon_ip: ${{ secrets.TOROPON_IP }}
           TF_VAR_argotunnel_cname_target: ${{ secrets.ARGOTUNNEL_CNAME_TARGET }}
           TF_VAR_gh_pages_challenge_content: ${{ secrets.GH_PAGES_CHALLENGE_CONTENT }}
-        run: terraform apply -auto-approve -no-color
diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml
index 3d575fa..48e4cc3 100644
--- a/.github/workflows/terraform-plan.yml
+++ b/.github/workflows/terraform-plan.yml
@@ -2,40 +2,22 @@ name: "Terraform Plan"
 
 on:
   pull_request:
-    branches:
-      - main
+    branches: [main]
 
 permissions:
   contents: read
 
 jobs:
   plan:
-    name: "Terraform Plan"
     runs-on: ubuntu-latest
-    
+    env:
+      TF_CLI_ARGS: "-no-color"
+
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
 
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@v4
 
-      - name: Terraform Init
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        run: |
-          terraform init \
-            -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
+      - run: terraform init -backend=false
 
-      - name: Terraform Plan
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          TF_VAR_cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          TF_VAR_toropon_ip: ${{ secrets.TOROPON_IP }}
-          TF_VAR_argotunnel_cname_target: ${{ secrets.ARGOTUNNEL_CNAME_TARGET }}
-          TF_VAR_gh_pages_challenge_content: ${{ secrets.GH_PAGES_CHALLENGE_CONTENT }}
-        run: terraform plan -no-color
+      - run: terraform validate

From 4ed8d2c55432d882daa6c08fef51c4153bc26d87 Mon Sep 17 00:00:00 2001
From: malken21 <77374813+malken21@users.noreply.github.com>
Date: Fri, 5 Jun 2026 17:49:27 +0900
Subject: [PATCH 2/2] Add job names to Terraform workflows

Set explicit job display names for the Terraform workflows by adding name: "Terraform Apply" to the apply job and name: "Terraform Plan" to the plan job. This improves readability in the GitHub Actions UI without changing job behavior.
---
 .github/workflows/terraform-apply.yml | 1 +
 .github/workflows/terraform-plan.yml  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
index 72c5317..5b27418 100644
--- a/.github/workflows/terraform-apply.yml
+++ b/.github/workflows/terraform-apply.yml
@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   apply:
+    name: "Terraform Apply"
     runs-on: ubuntu-latest
     environment: production
     env:
diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml
index 48e4cc3..a2c2966 100644
--- a/.github/workflows/terraform-plan.yml
+++ b/.github/workflows/terraform-plan.yml
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   plan:
+    name: "Terraform Plan"
     runs-on: ubuntu-latest
     env:
       TF_CLI_ARGS: "-no-color"